WordPress 7.1.3 Security Release: SQL Injection and XSS Fixes

WordPress 7.1.3 came out on October 6, 2026. It fixes seven security flaws in WordPress core, including a stored cross-site scripting (XSS) bug on the Comments screen and a second-order SQL injection in the WXR export tool, plus four regular bugs.¹ Every site running WordPress 7.1.0 through 7.1.2 should update. WordPress released patched versions for every branch back to 5.0 the same day, and says backports for older branches will ship as they become ready.¹⁴

The WordPress announcement does not mention attacks, and SecurityOnline reports no confirmed exploitation or public proof of concept.¹⁶ That gives you a window to patch before attackers work backward from the fix. This guide covers what each fix means in plain English, which sites are more exposed, and the exact steps to update today.

The short version

• What: WordPress 7.1.3 is a security and maintenance release with 7 security fixes and 4 bug fixes.¹
• When: October 6, 2026. WordPress 7.0.7 and backports for the 5.0 through 6.9 branches shipped the same day.⁴
• Headline flaws: A stored XSS on the Comments admin page that fires through pending comments, and a second-order SQL injection in WXR export.¹
• Who can trigger them: It varies. Per Patchstack, two start with a logged-out visitor (the Comments XSS also needs a moderator's click), three need a Contributor or Author account, the SQL injection needs an administrator to run an export, and one depends on your plugins.³
• Severity and CVEs: WordPress has published no CVE IDs and no severity scores for these flaws.¹⁵
• Exploited? WordPress mentions no attacks. SecurityOnline reports no confirmed exploitation in the wild or public proof of concept.¹⁶
• Do this: Check Dashboard > Updates, confirm 7.1.3 (or your branch's patched release), then review who holds Contributor, Author and Editor accounts.

What does WordPress 7.1.3 fix?

WordPress lists seven security fixes in the 7.1.3 announcement.¹ Patchstack published a technical breakdown the same day that names the access each one needs.³ The table combines both.

Flaw	Who can trigger it	Reported by
Stored XSS on the Comments admin page	Someone who leaves a pending comment, once an Editor or higher clicks a link in it	Thomas Chauchefoin, Trail of Bits
Second-order SQL injection in WXR export	An administrator running a single-type export while a bad _thumbnail_id value sits in the database	Anthropic
Denial of service in WP_Http::make_absolute_url()	A Contributor or higher account	Anthropic
Authors can make posts sticky	An Author or higher account	Anthropic
Comments on private and unpublished posts leak	Anyone, no login needed	Ananda Dhakal, Patchstack
XSS through Imgur embeds	A Contributor or higher account, plus someone who views the post	Zhengyu Liu, Jingcheng Yang, Gavin Zhong
Action name collision through the {status}_{type} hook	A plugin that passes a raw status or post type into wp_insert_post()	Alex Concha, WordPress security team

Sources: WordPress for the flaw list and credits, Patchstack for the access levels.¹³

The release touches nine core files, including wp-admin/includes/export.php, wp-includes/class-wp-http.php, wp-includes/class-wp-oembed.php and the REST posts controller. No bundled packages changed.²

What is the stored XSS in WordPress 7.1.3, in plain English?

Cross-site scripting means an attacker gets their own JavaScript to run inside someone else's browser on your site. "Stored" means the script is saved in your database and waits for a victim.

In this case the script hides in a comment that is waiting for approval. Patchstack says the attack needs "a pending comment and a moderator (Editor+)" who clicks a link in it.³ The bug sat in a Help tab click handler in wp-admin/js/common.js, which passed a link's address to jQuery in a way that builds HTML.³ The link also needs a wrapper with a specific CSS class, and visitor comments could not carry a class before WordPress 7.1.0. That is why Patchstack lists the pending-comment attack as affecting 7.1.0 through 7.1.2, and says the older backports harden the same code.³

The risk sits with the moderator's session. Script that runs while an Editor or Administrator is logged in can act with their permissions. Patchstack documented what that looks like in a separate plugin campaign the same week: stored XSS in two plugins was used to install a malicious plugin and create a hidden administrator account. Patchstack first saw that payload on October 4, 2026 and reports active exploitation.⁷ That campaign targets WPC Product Bundles for WooCommerce and Ninja Forms, not WordPress core.⁷ A bug that needs a moderator's click can still hand an attacker that moderator's session.

The second XSS fix covers Imgur embeds. Imgur was on WordPress's list of trusted embed providers, so its responses skipped the usual filtering.³ WordPress 7.1.3 removes Imgur from that list. Patchstack notes the fix "does not remove any existing, cached oEmbed content." That cached embed data lives in your database, so an existing malicious Imgur embed keeps rendering after the update.³

What is the SQL injection in WordPress 7.1.3, in plain English?

SQL injection means attacker-controlled text ends up inside a database query and changes what the query does. "Second-order" means the bad value gets stored first, looks harmless, and only causes damage when WordPress reuses it in a later query.⁵

Here, the stored value is a post's featured image ID (the _thumbnail_id field). When an administrator runs Tools > Export, the WXR exporter collected those IDs "straight from _thumbnail_id metadata" and placed them in a query without checking they were whole numbers.³ WordPress 7.1.3 forces each ID to an integer at three points.³ Patchstack says the vulnerable code has existed since WordPress 6.5.0 and only runs when you export a single content type. The default "All content" export doesn't touch it.³

Two things have to line up for an attack. A malformed _thumbnail_id must already be in your database, and an administrator must run a single-type export. Patchstack does not describe how an attacker would plant that value. In our reading, the likely paths are user accounts that can edit post data, plugins that write post meta, and content imported from other sites.

What do the other five WordPress 7.1.3 fixes do?

• Denial of service. A loop in WP_Http::make_absolute_url() never ended on a relative path like a//../b. Patchstack says a Contributor or higher can trigger it through the block editor's link preview.³
• Authors making posts sticky. The REST API only refused a sticky request when the user lacked both required capabilities, instead of either one. Authors could pin posts to the top of your blog.³
• Comment disclosure. For single-post comment feeds, WordPress loaded a post's comments before checking whether the visitor was allowed to see that post. Comments on private and unpublished posts leaked to logged-out visitors.³
• Hook collision. A post saved with the status delete and the type post fired the delete_post action, so plugins hooked to deletions ran as if a post had been deleted. WordPress 7.1.3 only fires those hooks for registered statuses and post types.³
• Imgur XSS. Covered above.

How serious is WordPress 7.1.3, and is anyone exploiting it?

WordPress did not publish CVE IDs or severity scores for any of the seven flaws.¹⁵ When we checked the WordPress security advisories on GitHub, the newest entries dated from September 22, 2026, with nothing yet for 7.1.3.⁸ If CVE IDs appear later, they will show up there and in the National Vulnerability Database.

SecurityOnline reports that "no exploitation in the wild or public proof-of-concept has been confirmed" for these issues.⁶ Cyber Kendra notes the WordPress announcement makes no mention of attacks.⁵

Patchstack puts it this way: "Update as soon as you can, but this isn't a drop-everything emergency."³ We agree with the first half. Patch details are public now, and attackers started probing for the 7.1.2 flaw within hours of that patch.¹² Treat 7.1.3 as a same-day job.

How does WordPress 7.1.3 relate to WordPress 7.1.2?

WordPress 7.1.2 shipped on September 22, 2026 to fix one flaw, CVE-2026-87902, a critical, actively exploited path traversal bug. We covered it in our CVE-2026-87902 guide. The seven flaws in 7.1.3 are separate issues.¹³ 7.1.3 is the next release on the same branch, so updating to it also brings in the 7.1.2 fix. Sites already on 7.1.2 still need 7.1.3, because none of these seven fixes are in 7.1.2. The same goes for older branches. If you updated to 6.9.9 for CVE-2026-87902, you now need 6.9.10.⁴

Timeline: WordPress 7.1 security releases

Date (2026)	What happened
August 19	WordPress 7.1 released.4
September 17	WordPress 7.1.1 released.4
September 22	WordPress 7.1.2 released to fix CVE-2026-87902.4
October 6	WordPress 7.1.3 and 7.0.7 released, with backports for branches 5.0 through 6.9.14
October 6	Patchstack publishes its technical breakdown of the seven fixes. At publication it reported backports through 6.6 only.3
October 6, when checked	No CVE IDs, no new GitHub advisories, and no 4.7 to 4.9 releases yet in the WordPress release archive.48

Which WordPress version fixes these flaws on my branch?

WordPress says the security fixes are being backported, "where necessary," to all branches eligible for security fixes, "currently through 4.7." It also says only the most recent version is actively supported.¹ Patchstack's article said only branches through 6.6 had shipped when it published.³ The WordPress release archive is the record to trust here, and it listed these October 6 releases when we checked.⁴

If your site runs	Update to at least
7.1.x	7.1.3
7.0.x	7.0.7
6.9.x	6.9.10
6.8.x	6.8.11
6.7.x	6.7.10
6.6.x	6.6.10
6.5.x	6.5.13
6.4.x	6.4.13
6.3.x	6.3.13
6.2.x	6.2.14
6.1.x	6.1.15
6.0.x	6.0.17
5.0.x to 5.9.x	The October 6 release for your branch (for example 5.9.19 or 5.0.30)
4.7.x to 4.9.x	No release yet. WordPress says backports "will ship as they become ready."1

Not every flaw exists on every branch. The Comments XSS starts at 7.1.0 and the WXR SQL injection at 6.5.0, per Patchstack.³ A backport keeps you covered for now. If you are still on a 4.x or 5.x branch, plan the move to 7.1.

How do I update to WordPress 7.1.3?

Take a backup of your files and database first, and confirm the backup is there and usable. WordPress recommends both before any upgrade.⁹ Then pick the route that matches how your site is run.

From the dashboard

Go to Dashboard > Updates and click "Update Now."¹ You need an Administrator account. If your site is on an older branch, read which version the button offers before you click. A jump to a new major version is a bigger change than a security patch, so test it on a staging copy first (our recommendation).

With WP-CLI

If you or your developer use WP-CLI, wp core version prints the installed version.¹¹ Use wp core update --minor to install only the minor release for your current branch, such as 7.1.3 on 7.1 or 6.9.10 on 6.9. Plain wp core update installs the newest version by default, which on an older branch means a major upgrade.¹⁰ Run wp core version again afterward to confirm.

Host-managed or agency-managed sites

WordPress says sites that support automatic background updates will start the update on their own.¹ Minor releases like 7.1.3 install automatically by default unless someone turned that off.⁹ Many managed hosts and agencies control core updates themselves, so ask them for the date they deployed 7.1.3 on each site. Then confirm the version yourself in Dashboard > Updates.

How do I tell if my site is affected?

You can run all of these checks from the WordPress dashboard. None need a developer.

1. Version. Dashboard > Updates shows your version. Anything from 7.1.0 to 7.1.2 needs the update. On an older branch, compare against the table above.
2. Automatic updates. Same screen. If WordPress says automatic updates are off, someone disabled them, often with AUTOMATIC_UPDATER_DISABLED or WP_AUTO_UPDATE_CORE set to false in wp-config.php.⁹
3. Who holds accounts. Go to Users > All Users and look at the role counts at the top. Contributor and Author accounts can reach three of the seven flaws.³ Membership sites, multi-author blogs and sites with guest writers are the most exposed.
4. Pending comments. Go to Comments > Pending. A queue full of comments with links is the setup the Comments XSS needs. Don't click links inside them until you have updated.
5. Imgur embeds. Search your posts for "imgur." The update does not remove embed data WordPress already cached, so an existing malicious embed keeps rendering.³ If you find Imgur embeds you did not add or don't trust, remove them from the post, and clear your caches after updating as Patchstack advises.³
6. Private and draft posts with comments. If you keep internal discussion in comments on private or unpublished posts, logged-out visitors can read those comments through the comment feed until you patch.³
7. Other copies. Staging sites, dev subdomains and old installs on the same server need the same update.

What if I can't update WordPress today?

Updating is the only fix WordPress offers. If something blocks it today, these steps cut exposure in the meantime (our recommendations, based on the access each flaw needs):

• Moderators: Don't click links inside pending comments. Approve, trash or mark as spam from the list view.
• Administrators: Hold off on Tools > Export until you are on 7.1.3. If you must export, use the default "All content" option, which Patchstack says does not reach the vulnerable code.³
• Accounts: Pause new Contributor and Author sign-ups and remove accounts nobody uses. Patchstack's advice is to "audit who holds Contributor or higher roles."³
• Embeds: Don't add new Imgur embeds.
• Private content: Move anything sensitive out of comments on private or draft posts.

Then book the update for tomorrow at the latest. If an update fails on your staging copy because of a plugin conflict, that conflict is the thing to fix. Staying on 7.1.2 leaves all seven flaws open.

Your WordPress 7.1.3 checklist

Today

1. Check the version on every live site, using Dashboard > Updates or wp core version.
2. Back up, then update to 7.1.3 or your branch's patched release.
3. Clear your caches (plugin cache, host cache and CDN) after updating, as Patchstack advises, and check any Imgur embeds.³
4. Ask your host or agency for the deploy date if they manage core updates.

This week

5. Audit user roles. Remove stale Contributor, Author and Editor accounts. Downgrade anyone who no longer needs to publish.
6. Review pending comments after the update and clear out spam with links.
7. Turn automatic updates back on if someone disabled them. At minimum, allow minor releases with WP_AUTO_UPDATE_CORE set to 'minor'.⁹ Our WordPress auto-update guide covers how to set a sensible update policy.
8. Patch staging and dev copies or take them offline.

This month

9. Plan the jump off old branches. If any site runs 4.x or 5.x, schedule the move to 7.1. Backports for 4.7 to 4.9 had not shipped when we checked.⁴
10. Set a patch rule. Apply WordPress security releases within 24 hours and name the person responsible (our recommendation). WordPress shipped 7.1.1, 7.1.2 and 7.1.3 within 19 days.⁴

If you find signs that an account or plugin was abused before you patched, our hacked WordPress site playbook covers the first hours.

Frequently asked questions

Is WordPress 7.1.3 a security update?

Yes. WordPress 7.1.3 is a security and maintenance release with seven security fixes and four bug fixes. WordPress recommends updating immediately.¹

Does WordPress 7.1.3 install automatically?

On most sites, yes. Minor releases install automatically by default, and WordPress says sites that support automatic background updates will start the update on their own. Check Dashboard > Updates to confirm, especially if a host or agency controls your updates.

I already updated to WordPress 7.1.2. Do I still need 7.1.3?

Yes. WordPress 7.1.2 fixed a different flaw, CVE-2026-87902. The seven flaws fixed in 7.1.3 are separate, and none of those fixes are in 7.1.2.

Do the WordPress 7.1.3 flaws have CVE numbers?

Not yet. WordPress has not published CVE IDs or severity scores for any of the seven flaws, and no matching GitHub advisory was listed when we checked on October 6, 2026.

Is anyone exploiting the WordPress 7.1.3 vulnerabilities?

Not that anyone has reported. WordPress mentions no attacks, and SecurityOnline reports no confirmed exploitation in the wild or public proof of concept. That can change once attackers study the patch, so update now rather than waiting for reports.

Which sites are most at risk from the WordPress 7.1.3 flaws?

Sites that give out Contributor, Author or Editor accounts, such as membership sites, multi-author blogs and sites with guest writers. Sites on 7.1.0 to 7.1.2 that accept public comments and moderate them in the dashboard are exposed to the Comments XSS. Sites with auto-updates turned off stay exposed longest.

If you want help

If you run several WordPress sites and want to know which ones patched, which accounts can reach these flaws, and which installs are stuck on old branches, send us the list through /start. You'll get a scoped estimate within 48 hours.

Sources

Facts checked on October 6, 2026.